CVE-2024-56161 — AMD / AMD EPYC™ 7001 Series

Description (CNA)

Improper signature verification in AMD CPU ROM microcode patch loader may allow an attacker with local administrator privilege to load malicious CPU microcode resulting in loss of confidentiality and integrity of a confidential guest running under AMD SEV-SNP.

Affected (CNA)

Vendor / product	Versions
AMD / AMD EPYC™ 7001 Series	unaffected NaplesPI 1.0.0.P
AMD / AMD EPYC™ 7002 Series	unaffected RomePI 1.0.0.L
AMD / AMD EPYC™ 7003 Series	unaffected MilanPI 1.0.0.F
AMD / AMD EPYC™ 9004 Series	unaffected Genoa 1.0.0.E

CWE

CWE-347

References

https://www.amd.com/en/resources/product-security/bulletin/amd-sb-3019.html

ADP enrichment

CVE

No English description supplied.

http://www.openwall.com/lists/oss-security/2025/02/04/1
http://www.openwall.com/lists/oss-security/2025/03/06/2
https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7033.html
https://lists.debian.org/debian-lts-announce/2025/03/msg00024.html

CISA-ADP

No English description supplied.

No references supplied.